Palo Alto Trust Protection Foundation up to 24.1.12/24.3.5/25.1.7/25.3.2 information expsure

Summaryinfo

A vulnerability classified as problematic was found in Palo Alto Trust Protection Foundation up to 24.1.12/24.3.5/25.1.7/25.3.2. This affects an unknown part. Executing a manipulation can lead to information expsure. This vulnerability is handled as CVE-2026-0240. The attack can only be done within the local network. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Palo Alto Trust Protection Foundation up to 24.1.12/24.3.5/25.1.7/25.3.2. It has been declared as problematic. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a information expsure vulnerability. The CWE definition for the vulnerability is CWE-497. The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings.

The advisory is available at security.paloaltonetworks.com. This vulnerability was named CVE-2026-0240 since 11/03/2025. The exploitation appears to be easy. The attack needs to approached within the local network. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

Upgrading to version 24.1.13, 24.3.6, 25.1.8 or 25.3.3 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Palo Alto

Name

• Trust Protection Foundation

Version

• 24.1.0
• 24.1.1
• 24.1.2
• 24.1.3
• 24.1.4
• 24.1.5
• 24.1.6
• 24.1.7
• 24.1.8
• 24.1.9
• 24.1.10
• 24.1.11
• 24.1.12
• 24.3.0
• 24.3.1
• 24.3.2
• 24.3.3
• 24.3.4
• 24.3.5
• 25.1.0
• 25.1.1
• 25.1.2
• 25.1.3
• 25.1.4
• 25.1.5
• 25.1.6
• 25.1.7
• 25.3.0
• 25.3.1
• 25.3.2

License

• commercial

Website

• Vendor: https://www.paloaltonetworks.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion